The Manticore Project
GitHub Discord Get Started
Generated from Manticore v1.1.6 • 388 packages. View on pkg.go.dev

msdtyp

import "github.com/TheManticoreProject/Manticore/windows/ms-dtyp"

Package msdtyp provides the [MS-DTYP] Windows Data Types as a single canonical set of Go types shared across the codebase: the DCE/RPC interfaces and protocols (which marshal them with the reflection walker in network/dcerpc/ndr via the struct tags on these types), and the fixed-layout consumers (SMB, Active Directory replication).

The package is intentionally dependency-light: it imports only windows/guid and the standard library, never network/dcerpc/ndr. The `ndr:"…"` struct tags are inert string metadata that the external NDR walker interprets; they do not couple this package to the codec, so non-RPC consumers can reuse the same definitions without pulling in the RPC stack.

It contains the scalar type aliases ([MS-DTYP] 2.2, e.g. DWORD, WORD, WCHAR, ULONG), the common structures ([MS-DTYP] 2.3, e.g. GUID, RPC_SID, RPC_UNICODE_STRING, LUID, FILETIME, SYSTEMTIME, LARGE_INTEGER), and their conversion/formatting helpers.

References:

Index

Constants

Thursday, January 1, 1970 1:00:00 AM GMT+01:00 in 100-nanosecond intervals

const UnixTimestampIn100NsIntervals int64 = 116444736000000000

type ADCONNECTION\_HANDLE

ADCONNECTION_HANDLE Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/5faf669e-34a9-471b-aaff-8591b9650189

type ADCONNECTION_HANDLE = uintptr

type BOOL

A BOOL is a 32-bit field that is set to 1 to indicate TRUE, or 0 to indicate FALSE Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/9d81be47-232e-42cf-8f0d-7a3b29bf2eb2

type BOOL = uint32

type BOOLEAN

A BOOLEAN is an 8-bit field that is set to 1 to indicate TRUE, or 0 to indicate FALSE. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/51bbfbb1-08e2-4c13-a95e-1eaa7d310670

type BOOLEAN = uint8

type BSTR

A BSTR is a pointer to a null-terminated character string in which the string length is stored with the string. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/692a42a9-06ce-4394-b9bc-5d2a50440168

type BSTR = []WCHAR

type BYTE

A BYTE is an 8-bit unsigned value that corresponds to a single octet in a network protocol. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/d7edc080-e499-4219-a837-1bc40b64bb04

type BYTE = UCHAR

type CHAR

A CHAR is an 8-bit block of data that typically contains an ANSI character, as specified in ISO/IEC\-8859\-1. For information on the char keyword, see [C706] section 4.2.9.3. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/77e1033f-b31d-4bd2-b3d5-9f3c9faa22eb

type CHAR = byte

type DOUBLE

A DOUBLE is an 8-byte, double-precision, floating-point number that represents a double-precision, 64-bit [IEEE754] value with the approximate range: +/-5.0 x 10-324 through +/-1.7 x 10308. The DOUBLE type can also represent not a number (NAN); positive and negative infinity; or positive and negative 0. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/40beeef3-303a-40de-895c-11379fc42c15

type DOUBLE = float64

type DWORD

A DWORD is a 32-bit unsigned integer (range: 0 through 4294967295 decimal). Because a DWORD is unsigned, its first bit (Most Significant Bit (MSB)) is not reserved for signing. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/262627d8-3418-4627-9218-4ffe110850b2

type DWORD = uint32

type DWORD32

A DWORD32 is a 32-bit unsigned integer. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/e359fcc1-35c6-4bcd-964d-d59927aeea98

type DWORD32 = uint32

type DWORD64

A DWORD64 is a 64-bit unsigned integer. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/3f3bd817-6fdd-4db9-b542-f800f876007d

type DWORD64 = uint64

type DWORDLONG

A DWORDLONG is a 64-bit unsigned integer (range: 0 through 18446744073709551615 decimal). Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/c575fb47-166c-48cd-a37c-e44cac05c3d6

type DWORDLONG = uint64

type DWORD\_PTR

A DWORD_PTR is a pointer to a DWORD. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/66d61dd8-2191-4a37-b963-e49bf0dc2579

type DWORD_PTR = *DWORD

type ERROR\_STATUS\_T

ERROR_STATUS_T Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/802ada7f-c5fc-415e-8438-c7369bb4193b

type ERROR_STATUS_T = ULONG

type EVENT\_DESCRIPTOR

The EVENT_DESCRIPTOR structure specifies the metadata that defines an event. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/a6110d36-28c1-4290-b79e-26aa95a0b1a0

type EVENT_DESCRIPTOR struct {
    Id      USHORT
    Version UCHAR
    Channel UCHAR
    Level   UCHAR
    Opcode  UCHAR
    Task    USHORT
    Keyword ULONGLONG
}

type EVENT\_HEADER

The EVENT_HEADER structure defines the main parameters of an event. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/fa4f7836-06ee-4ab6-8688-386a5a85f8c5

type EVENT_HEADER struct {
    Size            USHORT
    HeaderType      USHORT
    Flags           USHORT
    EventProperty   USHORT
    ThreadId        ULONG
    ProcessId       ULONG
    TimeStamp       LARGE_INTEGER
    ProviderId      GUID
    EventDescriptor EVENT_DESCRIPTOR
    KernelTime      ULONG
    UserTime        ULONG
    ProcessorTime   ULONG64
    ActivityId      GUID
}

type FILETIME

The FILETIME structure is a 64-bit value that represents the number of 100-nanosecond intervals that have elapsed since January 1, 1601, Coordinated Universal Time (UTC). Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/2c57429b-fdd4-488f-b5fc-9e4cf020fcdf

type FILETIME struct {
    // dwLowDateTime: A 32-bit unsigned integer that contains the low-order bits of the file time.
    DwLowDateTime uint32
    // dwHighDateTime: A 32-bit unsigned integer that contains the high-order bits of the file time.
    DwHighDateTime uint32
}

func NewFILETIMEFromTime

func NewFILETIMEFromTime(t time.Time) *FILETIME

NewFILETIMEFromTime creates a new FILETIME structure from a time.Time value.

Parameters: - t: The time.Time value to create the FILETIME structure from

Returns: - A pointer to the new FILETIME structure

func (*FILETIME) GetTime

func (ft *FILETIME) GetTime() time.Time

GetTime returns the time represented by the FILETIME structure.

Returns: - The time represented by the FILETIME structure

func (*FILETIME) GetTimeString

func (ft *FILETIME) GetTimeString() string

GetTimeString returns the string representation of the FILETIME structure in UTC.

Returns: - The string representation of the FILETIME structure in UTC

func (*FILETIME) GetUnixTimestamp

func (ft *FILETIME) GetUnixTimestamp() int64

GetUnixTimestamp returns the Unix timestamp represented by the FILETIME structure.

Returns: - The Unix timestamp as an int64

func (*FILETIME) Marshal

func (ft *FILETIME) Marshal() ([]byte, error)

Marshal serializes the FILETIME structure into a byte slice. It converts the FILETIME structure into its binary representation according to the SMB protocol format.

Returns: - A byte slice containing the marshalled FILETIME structure

func (*FILETIME) String

func (ft *FILETIME) String() string

String returns the string representation of the FILETIME structure in UTC.

Returns: - The string representation of the FILETIME structure in UTC

func (*FILETIME) ToInt64

func (ft *FILETIME) ToInt64() int64

ToInt64 returns the int64 representation of the FILETIME structure.

Returns: - The int64 representation of the FILETIME structure

func (FILETIME) Uint64

func (ft FILETIME) Uint64() uint64

Uint64 returns the FILETIME as a single 64-bit value (high half in the upper 32 bits).

func (*FILETIME) Unmarshal

func (ft *FILETIME) Unmarshal(data []byte) (int, error)

Unmarshal deserializes a byte slice into the FILETIME structure.

Parameters: - data: A byte slice to be deserialized into the FILETIME structure

type FLOAT

A FLOAT is a base type that is specified the IEEE Format section of [C706].section 14.2. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/73ba97b0-bbe5-483d-a0a8-46298ebcb160

type FLOAT = float32

type GUID

GUID is the [MS-DTYP] 2.3.4.2 GUID in its NDR-marshallable form: Data1 (4 octets), Data2 (2), Data3 (2), and Data4 (8 opaque octets), for 16 octets total with 4-octet alignment. Data1/2/3 are little-endian integers; Data4 is transmitted verbatim.

The reflection walker cannot use windows/guid.GUID directly: its Go layout ends in a uint64, which over-aligns the struct to 8 and inserts interior padding, so it would marshal as 24 octets instead of 16. This type mirrors the wire layout exactly. Use NewGUID / GUID to convert to and from windows/guid.GUID.

Reference: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/49e490b8-f972-45d6-a3a4-99f924998d97

type GUID struct {
    Data1 uint32
    Data2 uint16
    Data3 uint16
    Data4 [8]byte
}

func NewGUID

func NewGUID(g guid.GUID) GUID

NewGUID converts a windows/guid.GUID to its NDR GUID form.

func (GUID) GUID

func (g GUID) GUID() guid.GUID

GUID converts back to a windows/guid.GUID.

func (GUID) String

func (g GUID) String() string

String renders the GUID in the standard “D” format.

type HANDLE

HANDLE Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/929187f0-f25c-4b05-9497-16b066d8a912

type HANDLE = uintptr

type HCALL

HCALL Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/4958db44-2d75-4ccf-a4ba-3b8b1ec56360

type HCALL = DWORD

type HRESULT

HRESULT Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/a9046ed2-bfb2-4d56-a719-2824afce59ac

type HRESULT = LONG

type INT

INT Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/2d70b269-ed8e-4a5d-8384-b3cd4d9e24f8

type INT = int32

type INT16

INT16 Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/c19c7f85-a511-4407-a7bf-5da9fa79d026

type INT16 = int16

type INT32

INT32 Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/b9218cdd-e76a-4c13-bb2d-c322dc39505b

type INT32 = int32

type INT64

INT64 Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/cfb2030b-0d7a-4808-8539-32f35bd9325f

type INT64 = int64

type INT8

INT8 Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/fc85cdcc-92f3-46ef-a2aa-501f44d0968a

type INT8 = int8

type LARGE\_INTEGER

LARGE_INTEGER is the [MS-DTYP] 2.3.5 signed 64-bit integer. It is a named type rather than a bare int64 so declarations read like the IDL and it carries 8-octet NDR alignment ([C706] section 14.2.2).

Reference: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/e904b1ba-f774-4203-ba1b-66485165ab1a

type LARGE_INTEGER int64

type LCID

A language code identifier structure is stored as a DWORD. The lower word contains the language identifier, and the upper word contains both the sorting identifier (ID) and a reserved value. For additional details about the structure and possible values, see [MS-LCID]. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/e8e4255f-5b6d-472b-8a98-ae3950bfdb9a

type LCID = DWORD

type LDAP\_UDP\_HANDLE

LDAP_UDP_HANDLE Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/b0e4f011-fea4-473f-a678-be5e5a33f4cf

type LDAP_UDP_HANDLE = uintptr

type LMCSTR

LMCSTR Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/34971db0-e83a-473e-aa5e-c4f3691c7f6d

type LMCSTR = []WCHAR

type LMSTR

LMSTR Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/783140f9-5cb9-499e-a7a7-722214b27733

type LMSTR = []WCHAR

type LONG

A LONG is a 32-bit signed integer, in twos-complement format (range: -2147483648 through 2147483647 decimal). The first bit (Most Significant Bit (MSB)) is the signing bit. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/29d44d70-382f-4998-9d76-8a1fe93e445c

type LONG = int32

type LONG32

A LONG32 is a 32-bit signed integer. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/286e80a4-16fa-45d5-b97d-aeac136ef3f0

type LONG32 = int32

type LONG64

A LONG64 is a 64-bit signed integer. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/7dc8dc9c-9d54-417a-933e-173933f0c329

type LONG64 = int64

type LONGLONG

A LONGLONG is a 64-bit signed integer (range: -9223372036854775808 through 9223372036854775807 decimal). Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/e34f8048-e2d0-4f5b-99fd-0b6489ee0295

type LONGLONG = int64

type LONG\_PTR

A LONG_PTR is a long type used for pointer precision. It is used when casting a pointer to a long type to perform pointer arithmetic. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/bbcfb0af-8349-4e98-ad26-957e1363f714

type LONG_PTR = uintptr

type LPCSTR

An LPCSTR is a 32-bit pointer to a constant null-terminated string of 8-bit Windows (ANSI) characters. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/f8d4fe46-6be8-44c9-8823-615a21d17a61

type LPCSTR = *CHAR

type LPCVOID

An LPCVOID is a 32-bit pointer to a constant of any type. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/66996877-9dd4-477d-a811-30e6c1a5525d

type LPCVOID = uintptr

type LPCWSTR

An LPCWSTR is a 32-bit pointer to a constant string of 16-bit Unicode characters, which MAY be null-terminated. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/76f10dd8-699d-45e6-a53c-5aefc586da20

type LPCWSTR = *WCHAR

type LPSERVER\_INFO\_100

type LPSERVER_INFO_100 *SERVER_INFO_100

type LPSTR

The LPSTR type and its alias PSTR specify a pointer to an array of 8-bit characters, which MAY be terminated by a null character. In some protocols, it is acceptable to not terminate with a null character, and this option will be indicated in the specification. In this case, the LPSTR or PSTR type MUST either be tagged with the IDL modifier [string], that indicates string semantics, or be accompanied by an explicit length specifier, for example [size_is()]. The format of the characters MUST be specified by the protocol that uses them. Two common 8-bit formats are ANSI and UTF-8. A 32-bit pointer to a string of 8-bit characters, which MAY be null-terminated. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/3f6cc0e2-1303-4088-a26b-fb9582f29197

type LPSTR = *CHAR

type LPWSTR

The LPWSTR type is a 32-bit pointer to a string of 16-bit Unicode characters, which MAY be null-terminated. The LPWSTR type specifies a pointer to a sequence of Unicode characters, which MAY be terminated by a null character (usually referred to as “null-terminated Unicode”). In some protocols, an acceptable option is to not terminate a sequence of Unicode characters with a null character. Where this option applies, it is indicated in the protocol specification. In this situation, the LPWSTR or PWSTR type MUST either be tagged with the IDL modifier [string], which indicates string semantics, or MUST be accompanied by an explicit length specifier, as specified in the RPC_UNICODE_STRING (section 2.3.10) structure. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/50e9ef83-d6fd-4e22-a34a-2c6b4e3c24f3

type LPWSTR = *WCHAR

type LUID

The LUID structure is 64-bit value guaranteed to be unique only on the system on which it was generated. The uniqueness of a locally unique identifier (LUID) is guaranteed only until the system is restarted. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/48cbee2a-0790-45f2-8269-931d7083b2c3

type LUID struct {
    // LowPart: The low-order bits of the structure.
    LowPart DWORD
    // HighPart: The high-order bits of the structure.
    HighPart LONG
}

func LUIDFromUint64

func LUIDFromUint64(v uint64) LUID

LUIDFromUint64 splits a 64-bit value into a LUID.

func (LUID) Uint64

func (l LUID) Uint64() uint64

Uint64 returns the LUID as a single 64-bit value (HighPart in the upper 32 bits).

type MULTI\_SZ

The MULTI_SZ structure defines an implementation-specific type that contains a sequence of null-terminated strings, terminated by an empty string (\0) so that the last two characters are both null terminators. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/fd7b2d81-b1d7-414f-a3df-c66fabc578db

type MULTI_SZ struct {
    // Value: A data buffer, which is a string literal containing multiple null-terminated strings serially.
    Value WCHAR
    // NChar: The length, in characters, including the two terminating nulls.
    NChar DWORD
}

type NET\_API\_STATUS

NET_API_STATUS Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/19cdb498-c67b-42b7-a540-4bc6a73c04f6

type NET_API_STATUS = DWORD

type NTSTATUS

NTSTATUS is a standard 32-bit datatype for system-supplied status code values. NTSTATUS values are used to communicate system information. They are of four types: success values, information values, warnings, and error values, as specified in [MS-ERREF]. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/c8b512d5-70b1-4028-95f1-ec92d35cb51e

type NTSTATUS = LONG

type OBJECT\_TYPE\_LIST

OBJECT_TYPE_LIST Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/6f04f1f2-d070-4f70-aae7-5f98ed63e1ba

type OBJECT_TYPE_LIST struct {
    // Level: Specifies the level of the object type in the hierarchy of an object and its sub-objects. Level zero
    // indicates the object itself. Level one indicates a sub-object of the object, such as a property set. Level two
    // indicates a sub-object of the level one sub-object, such as a property. There can be a maximum of five levels
    // numbered zero through four.
    Level WORD
    // Remaining: Remaining access bits for this element, used by the access check algorithm, as specified in section 2.5.3.2.
    Remaining UINT32 // ACCESS_MASK
    // ObjectType: A pointer to the GUID for the object or sub-object.
    ObjectType *GUID
}

type PCONTEXT\_HANDLE

The PCONTEXT_HANDLE type keeps state information associated with a given client on a server. The state information is called the server’s context. Clients can obtain a context handle to identify the server’s context for their individual RPC sessions. A context handle must be of the void * type, or a type that resolves to void *. The server program casts it to the required type. The IDL attribute [context_handle], as specified in [C706], is used to declare PCONTEXT_HANDLE. An interface that uses a context handle must have a binding handle for the initial binding, which has to take place before the server can return a context handle. The handle_t type is one of the predefined types of the interface definition language (IDL), which is used to create a binding handle. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/b8d08028-e73f-4bb8-b3bf-bc8ba4734c4c

type PCONTEXT_HANDLE = uintptr

type PEVENT\_HEADER

type PEVENT_HEADER *EVENT_HEADER

type PLARGE\_INTEGER

type PLARGE_INTEGER *LARGE_INTEGER

type PLUID

type PLUID *LUID

type PMULTI\_SZ

type PMULTI_SZ *MULTI_SZ

type POBJECT\_TYPE\_LIST

type POBJECT_TYPE_LIST *OBJECT_TYPE_LIST

type PSERVER\_INFO\_100

type PSERVER_INFO_100 *SERVER_INFO_100

type PSYSTEMTIME

type PSYSTEMTIME *SYSTEMTIME

type PUINT128

type PUINT128 *UINT128

type PULARGE\_INTEGER

type PULARGE_INTEGER *ULARGE_INTEGER

type QWORD

A QWORD is a 64-bit unsigned integer. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/ac050bbf-a821-4fab-bccf-d95d892f428f

type QWORD = uint64

type RPC\_BINDING\_HANDLE

An RPC_BINDING_HANDLE is an untyped 32-bit pointer containing information that the RPC run-time library uses to access binding information. It is directly equivalent to the type rpc_binding_handle_t described in [C706] section 3.1.4. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/d0dffa33-812f-4214-a987-4ee149328eec

type RPC_BINDING_HANDLE = uintptr

type RPC\_SID

RPC_SID is the [MS-DTYP] 2.4.2.3 marshallable security identifier. The SubAuthority member is a conformant array whose element count is given by SubAuthorityCount, so NDR hoists its maximum_count to the front of the structure ([C706] section 14.3.3.1); the walker derives both the hoisted count and SubAuthorityCount from the slice length, so callers set only SubAuthority (or use ParseSID).

IdentifierAuthority is a 6-octet big-endian value transmitted verbatim ([MS-DTYP] 2.4.1 RPC_SID_IDENTIFIER_AUTHORITY). SubAuthorityCount is capped at 15 by the spec.

Reference: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/5cb97814-a1c2-4215-b7dc-76d1f4bfad01

type RPC_SID struct {
    Revision            uint8
    SubAuthorityCount   uint8
    IdentifierAuthority [6]byte
    SubAuthority        []uint32 `ndr:"conformant,size_is=SubAuthorityCount"`
}

func ParseSID

func ParseSID(s string) (RPC_SID, error)

ParseSID parses a textual SID (“S-1-5-21-…”) into an RPC_SID, setting Revision, IdentifierAuthority, and the SubAuthority array (SubAuthorityCount is derived on marshal). The identifier authority may be decimal or 0x-prefixed hexadecimal.

func (RPC_SID) String

func (s RPC_SID) String() string

String renders the SID in the standard “S-R-I-S1-S2-…” textual form ([MS-DTYP] 2.4.2.1 SID String Format): authorities below 2^32 are decimal, larger ones hex.

type RPC\_UNICODE\_STRING

RPC_UNICODE_STRING is the [MS-DTYP] 2.3.10 counted Unicode string. It is the single most common string carrier in the LSA/SAMR interfaces and, unlike a bare NDR wide string, cannot be modeled by ndr.WSTR because of a byte-vs-char gotcha:

  • Length and MaximumLength are counts in BYTES (each must be even), whereas
  • Buffer is a unique pointer to a conformant-varying array of wchar whose maximum_count is MaximumLength/2 and actual_count is Length/2 — counts in CHARS.

The buffer carries no NUL terminator (it is a size\_is/length\_is array, not an NDR [string]). Modeling Buffer as a []uint16 tagged “unique,varying” lets the walker emit the referent id inline and the char-counted conformant-varying body deferred, so the buffers of an array of RPC_UNICODE_STRING are correctly emitted after the whole array (see issue #419).

The size_is/length_is divisor tags resolve the wchar array’s maximum_count to MaximumLength/2 and actual_count to Length/2, which differ from len(Buffer) whenever the buffer is over-allocated (MaximumLength > Length, as a server may advertise). Use NewUnicodeString to set the byte counts and buffer together.

Reference: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/94a16bb6-c610-4cb9-8db6-26f15f560061

type RPC_UNICODE_STRING struct {
    Length        uint16   // length of the string in bytes, excluding any terminator
    MaximumLength uint16   // size of Buffer in bytes
    Buffer        []uint16 `ndr:"unique,varying,size_is=MaximumLength/2,length_is=Length/2"`
}

func NewUnicodeString

func NewUnicodeString(s string) RPC_UNICODE_STRING

NewUnicodeString builds an RPC_UNICODE_STRING from a Go string, encoding it to UTF-16 and setting Length and MaximumLength to the byte count (2 per code unit). An empty string yields a zero-length value with a NULL Buffer, matching the Windows representation of an empty counted string.

func (RPC_UNICODE_STRING) String

func (u RPC_UNICODE_STRING) String() string

String decodes the Buffer (truncated to Length/2 code units, as Length governs the valid portion) back to a Go string.

type SERVER\_INFO\_100

SERVER_INFO_100 Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/007c654b-7d78-49d4-9f4d-0da7c1889727

type SERVER_INFO_100 struct {
    // Sv100PlatformId: The platform ID.
    Sv100PlatformId DWORD
    // Sv100Name: The server name.
    Sv100Name WCHAR
}

type SERVER\_INFO\_101

SERVER_INFO_101 Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/39c502dd-022b-4a68-9367-89fd76a23bc3

type SERVER_INFO_101 struct {
    // sv101_platform_id: Specifies the information level to use for platform-specific information.
    Sv101PlatformId DWORD
    // sv101_name: A pointer to a null-terminated Unicode UTF-16 Internet host name or NetBIOS host name of a server.
    Sv101Name STRING
    // sv101_version_major: Specifies the major release version number of the operating system. The server MUST set this
    // field to an implementation-specific major release version number that corresponds to the host operating system as
    // specified in the following table.
    Sv101VersionMajor DWORD
    // sv101_version_minor: Specifies the minor release version number of the operating system. The server MUST set this
    // field to an implementation-specific minor release version number that corresponds to the host operating system as
    // specified in the following table.
    Sv101VersionMinor DWORD
    // sv101_version_type: The sv101_version_type field specifies the SV_TYPE flags, which indicate the software services
    // that are available (but not necessarily running) on the server. This member MUST be a combination of one or more of
    // the following values.
    Sv101VersionType DWORD
    // sv101_comment: A pointer to a null-terminated Unicode UTF-16 string that specifies a comment that describes the server.
    Sv101Comment STRING
}

type SHORT

A SHORT is a 16-bit signed integer(range: -32768 through 32767 decimal). The first bit (Most Significant Bit (MSB)) is the signing bit. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/47b1e7d6-b5a1-48c3-986e-b5e5eb3f06d2

type SHORT = int16

type SIZE\_T

SIZE_T is a ULONG_PTR representing the maximum number of bytes to which a pointer can point. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/1dc2ff19-6fef-4c5f-b4fd-afbc2557fd81

type SIZE_T = ULONG_PTR

type STRING

Unless otherwise noted, a STRING is a UCHAR buffer that represents a null-terminated string of 8-bit characters. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/08460486-bacc-48af-8520-195ff7f80db5

type STRING = []UCHAR

type SYSTEMTIME

SYSTEMTIME Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/2fefe8dd-ab48-4e33-a7d5-7171455a9289

type SYSTEMTIME struct {
    // WYear: The year.
    WYear WORD
    // WMonth: The month.
    WMonth WORD
    // WDayOfWeek: The day of the week.
    WDayOfWeek WORD
    // WDay: The day.
    WDay WORD
    // WHour: The hour.
    WHour WORD
    // WMinute: The minute.
    WMinute WORD
    // WSecond: The second.
    WSecond WORD
    // WMilliseconds: The milliseconds.
    WMilliseconds WORD
}

type UCHAR

A UCHAR is an 8-bit integer with the range: 0 through 255 decimal. Because a UCHAR is unsigned, its first bit (Most Significant Bit (MSB)) is not reserved for signing. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/050baef1-f978-4851-a3c7-ad701a90e54a

type UCHAR = uint8

type UINT

A UINT is a 32-bit unsigned integer (range: 0 through 4294967295 decimal). Because a UINT is unsigned, its first bit (Most Significant Bit (MSB)) is not reserved for signing. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/52ddd4c3-55b9-4e03-8287-5392aac0627f

type UINT = uint32

type UINT128

UINT128 Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/3b5c1a61-ece4-4dce-9c9f-c15388ba9032

type UINT128 struct {
    // Lower: The lower 64 bits of the 128-bit value.
    Lower UINT64
    // Upper: The upper 64 bits of the 128-bit value.
    Upper UINT64
}

type UINT16

A UINT16 is a 16-bit unsigned integer (range: 0 through 65535 decimal). Because a UINT16 is unsigned, its first bit (Most Significant Bit (MSB)) is not reserved for signing. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/6c1609ad-8592-45d3-9dfa-38e6a30ff203

type UINT16 = uint16

type UINT32

A UINT32 is a 32-bit unsigned integer (range: 0 through 4294967295 decimal). Because a UINT32 is unsigned, its first bit (Most Significant Bit (MSB)) is not reserved for signing. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/362b8d72-2245-4c33-84a8-08c69f4c302f

type UINT32 = uint32

type UINT64

A UINT64 is a 64-bit unsigned integer (range: 0 through 18446744073709551615 decimal). Because a UINT64 is unsigned, its first bit (Most Significant Bit (MSB)) is not reserved for signing. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/a7b7720f-87eb-4add-9bcb-c6ff652778ae

type UINT64 = uint64

type UINT8

A UINT8 is an 8-bit unsigned integer (range: 0 through 255 decimal). Because a UINT8 is unsigned, its first bit (Most Significant Bit (MSB)) is not reserved for signing. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/a88ed362-a905-4ed2-85f5-cfc8692c9842

type UINT8 = uint8

type ULARGE\_INTEGER

ULARGE_INTEGER is the [MS-DTYP] 2.3.13 unsigned 64-bit integer. It is a named type rather than a bare uint64 so declarations read like the IDL and it carries 8-octet NDR alignment ([C706] section 14.2.2).

Reference: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/d7e6e5a5-6c77-4ae6-9bd5-3892b3c4641e

type ULARGE_INTEGER uint64

type ULONG

A ULONG is a 32-bit unsigned integer (range: 0 through 4294967295 decimal). Because a ULONG is unsigned, its first bit (Most Significant Bit (MSB)) is not reserved for signing. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/32862b84-f6e6-40f9-85ca-c4faf985b822

type ULONG = uint32

type ULONG32

A ULONG32 is an unsigned LONG32. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/c9346e52-0765-4247-ab74-89c24ad3517b

type ULONG32 = uint32

type ULONG64

A ULONG64 is a 64-bit unsigned integer (range: 0 through 18446744073709551615 decimal). Because a ULONG64 is unsigned, its first bit (Most Significant Bit (MSB)) is not reserved for signing. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/2dc4c492-95db-4fa6-ae2b-8546b13c9141

type ULONG64 = uint64

type ULONGLONG

A ULONGLONG is a 64-bit unsigned integer (range: 0 through 18446744073709551615 decimal). Because a ULONGLONG is unsigned, its first bit (Most Significant Bit (MSB)) is not reserved for signing. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/c57d9fba-12ef-4853-b0d5-a6f472b50388

type ULONGLONG = uint64

type ULONG\_PTR

A ULONG_PTR is an unsigned long type used for pointer precision. It is used when casting a pointer to a long type to perform pointer arithmetic. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/21eec394-630d-49ed-8b4a-ab74a1614611

type ULONG_PTR = uintptr

type UNC

UNC Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/62e862f4-2a51-452e-8eeb-dc4ff5ee33cc

type UNC = string

type UNICODE

A single Unicode character. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/845b6fa4-c34a-4b90-824d-60e98533dfb5

type UNICODE = uint16

type USHORT

A USHORT is a 16-bit unsigned integer (range: 0 through 65535 decimal). Because a USHORT is unsigned, its first bit (Most Significant Bit (MSB)) is not reserved for signing. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/c0618c5b-362b-4e06-9cb0-8720d240cf12

type USHORT = uint16

type VOID

VOID is an alias for void. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/c0b7741b-f577-4eed-aff3-2e909df10a4d

type VOID = struct{}

type WCHAR

A WCHAR is a 16-bit Unicode character. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/7df7c1d5-492c-4db4-a992-5cd9e887c5d7

type WCHAR = UNICODE

type WORD

A WORD is a 16-bit unsigned integer (range: 0 through 65535 decimal). Because a WORD is unsigned, its first bit (Most Significant Bit (MSB)) is not reserved for signing. Source: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/f8573df3-a44a-4a50-b070-ac4c3aa78e3c

type WORD = uint16